CVE-2025-46347 is a critical flaw (CVSS 9.8) in YesWiki, a PHP wiki, in versions before 4.5.4. An arbitrary file write can place a file with a PHP extension on the server, which can then run code. The advisory says the issue is patched in 4.5.4, so upgrade and look for unexpected PHP files.
What's affected
The NVD record says YesWiki versions before 4.5.4 are affected, and the GitHub advisory lists the range as up to and including 4.5.3. Version 4.5.4 is the patched release.
The advisory describes the weakness in a feature that saves custom styling presets from the wiki's interface. The file name used by that feature could be changed, so the saved file ended up with a PHP extension and attacker supplied content. The record adds that this could potentially be triggered unwittingly by a user.
How to check if you're exposed
Find the YesWiki version and look at the files on disk.
- Open the wiki as an administrator and read the version from the about or administration page, or check the version in the project files of your install.
- Docker users: run the command shown below and check the tag for the YesWiki image.
- On the server, look in the wiki's upload and theme directories for files with a .php extension that you did not put there. A command such as
find . -name '*.php' -newer composer.jsonshows recent files for review. - Review web server access logs for requests to the templates and presets API paths from unfamiliar addresses.
Any version at or below 4.5.3 is in the affected range.
Commands referred to above, in order:
docker ps --format '{{.Image}}'
What to do now
- Upgrade YesWiki to 4.5.4 or later, following the project's upgrade notes and taking a backup first.
- Search the install for PHP files in directories that should hold only styles, images or uploads, and investigate anything unexpected.
- Block execution of PHP in upload and theme directories at the web server level as a defense in depth step.
- Limit who can reach editing and configuration features to logged in users where the wiki's settings allow it.
- Rotate database and admin credentials if you find a file you cannot explain.
- Check the second YesWiki advisory covering backup access (CVE-2025-46348), which is fixed in the same release.
Why it matters
The record lists CWE-116 (Improper Encoding or Escaping of Output). The core problem is that the application writes a file whose name or contents come from the request without limiting what extension or what text is allowed. When the web server runs files with a PHP extension, a written file becomes executable code.
The vector (AV:N, AC:L, PR:N, UI:N) puts this at the top of the scale for ease. Wikis are often exposed to the whole internet and run with write access to their own folders, so a file write issue leads quickly to full control of the server. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
A dynamic scan of a running web application is one way to catch exposed endpoints like this one. The demo shows what that looks like.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
YesWiki 4.5.4, according to the advisory.
Should I check my server after upgrading?
Yes. The upgrade closes the hole, but it does not remove a file that was already written. Look for unexpected PHP files.
Sources
Last reviewed: 18 October 2026.
